-- Rollback for T9 approved SSH execution MCP Gateway seed.
-- Contract revisions are append-only; rollback revokes approval_executor grants
-- and deactivates only the write/admin tools introduced here.

SELECT set_config('app.project_id', 'awoooi', FALSE);

UPDATE awooop_mcp_grants
SET
    is_revoked = TRUE,
    revoked_at = NOW(),
    revoked_by = 'rollback:t9_ssh_approval_gateway'
WHERE project_id = 'awoooi'
  AND agent_id = 'approval_executor'
  AND granted_by = 'migration:t9_ssh_approval_gateway'
  AND is_revoked = FALSE;

UPDATE awooop_mcp_tool_registry
SET
    is_active = FALSE,
    updated_at = NOW()
WHERE project_id = 'awoooi'
  AND tool_name IN (
      'ssh_docker_restart',
      'ssh_docker_compose_restart',
      'ssh_systemctl_restart',
      'ssh_clear_docker_logs',
      'ssh_renew_ssl',
      'ssh_reload_nginx',
      'ssh_docker_prune'
  );

DELETE FROM awooop_active_revisions
WHERE project_id = 'awoooi'
  AND contract_family = 'agent'
  AND contract_id = 'approval_executor';

UPDATE awooop_contract_revisions
SET lifecycle_status = 'revoked'
WHERE project_id = 'awoooi'
  AND contract_family = 'agent'
  AND contract_id = 'approval_executor'
  AND publisher_id = 'migration:t9_ssh_approval_gateway'
  AND lifecycle_status = 'active';
